CVE-2026-76865 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c due to unchecked atoi() results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 is susceptible to a critical null pointer dereference vulnerability located within its Quality of Service configuration interface. This flaw specifically affects the Common Gateway Interface handlers responsible for connection deletion and GRE priority settings, identified in the source files filter_conn_del_cgi.c and gre_prio_set_cgi.c respectively. The root cause of this security issue lies in improper input validation practices during the processing of user-supplied data. Specifically, the application utilizes the atoi function to convert string inputs into integer values for QoS parameters without verifying whether the conversion was successful or if the resulting value is valid. In C programming, when a non-numeric string is passed to atoi, it returns zero rather than raising an error, which can lead developers to incorrectly assume that a default or null state has been established safely. However, in this specific implementation context, the subsequent logic relies on pointers associated with these parsed values without performing necessary NULL checks before dereferencing them.
This architectural weakness allows for a straightforward denial of service attack vector against the target device. An attacker who can reach the CGI interface, typically through an unauthenticated web access point or via authenticated administrative credentials depending on the specific network configuration and exposure level, can supply crafted input strings that fail to parse into valid integers. When these malformed inputs are processed by the filter_conn_del_cgi.c and gre_prio_set_cgi.c handlers, the unchecked nature of the atoi results leads directly to a null pointer dereference event within the kernel or application space. The immediate operational impact is the crash of the CGI process or potentially the entire router firmware stack, resulting in a complete loss of network connectivity for all devices connected through this gateway. This disruption effectively renders the Netcore NR255-V unusable until it is manually rebooted by an administrator with physical access to the hardware.
From a classification perspective, this vulnerability aligns closely with CWE-476, which denotes a NULL Pointer Dereference, and CWE-20, indicating Improper Input Validation. The exploitation technique falls under MITRE ATT&CK tactic T1595, specifically Active Scanning or Vulnerability Scanning if used to probe for stability issues, but more accurately represents T1498 Network Denial of Service when the goal is service disruption. While this vulnerability does not currently appear to offer a path for arbitrary code execution or privilege escalation due to its crash-inducing nature, it poses a significant risk to network availability and reliability. The lack of robust error handling in embedded systems like routers often stems from resource constraints and legacy coding practices that prioritize functionality over resilience against malformed inputs.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. For administrators currently operating this firmware version, the most effective mitigation is to apply any available vendor patches or upgrade to a newer firmware release where these CGI handlers have been hardened with proper input validation logic. If patching is not immediately feasible, restricting access to the administrative web interface by placing it behind strong authentication mechanisms and network segmentation can reduce the attack surface significantly. Furthermore, implementing rate limiting on HTTP requests directed at CGI endpoints may help mitigate automated exploitation attempts. For developers and vendors, the resolution requires refactoring the affected C code to include explicit checks for NULL pointers before dereferencing them and validating that atoi conversions yield expected ranges rather than blindly trusting zero as a safe default value. This ensures that malformed inputs trigger appropriate error responses instead of causing system crashes.